CTOS Digital is a key player in the ASEAN credit reporting landscape, enabling digital credit solutions through strategic investment and innovation. We empower individuals and businesses with the confidence to make sound credit decisions through access to data and insights with greater ease and speed.

Role Overview

This role is responsible for executing and overseeing activities that assess and strengthen CTOS’ cybersecurity effectiveness through security assessments, exposure management, and remediation governance. The role supports the enterprise security program by consolidating security findings, tracking remediation efforts, coordinating with technical teams, and providing risk-based reporting to maintain a secure and resilient technology environment. This position works closely with cross-functional stakeholders to ensure security exposures are identified, assessed, prioritised, and remediated in a timely manner.

Key Responsibilities:

Vulnerability Management

· Support the implementation of cyber threat and vulnerability management (CTVM) program, across infrastructure, applications, cloud services, and digital assets.

· Plan, coordinate, and monitor vulnerability management activities, including vulnerability assessments, prioritisation, remediation tracking, and reporting.

· Maintain visibility of technology assets and validate the inventory of all IT hardware and software across CTOS technology environment.

Security Assessment and Assurance

· Plan and coordinate security assessments, including vulnerability scans, penetration tests, web application scans, configuration reviews, cloud security reviews, AI security assessments, and other relevant security evaluation activities.

· Define assessment scope, coordinate stakeholders, track assessment completion, review findings, and consolidate results for risk reporting and remediation follow-up.

· Support the SDLC programme by working with application development and DevOps teams to obtain, review, consolidate, and track outputs from application security testing performed through the DevSecOps pipeline, including static application security testing (SAST), dynamic application security testing (DAST), secret scanning, and software composition analysis.

· Review security-related requests from internal stakeholders and provide security recommendations and advisory.

· Promote and maintain good cyber hygiene and compliance with cybersecurity requirements.

· Stay current with latest cyber threats and vulnerabilities relevant to CTOS’ technologies and infrastructure.

External Exposure Monitoring

· Monitor external attack surface to identify internal-facing assets, exposed services, misconfigurations, vulnerable systems, and other externally accessible security exposures.

· Ensure identified exposures are investigated, risk-assessed, and remediated within established timelines.

· Monitor threat intelligence, emerging threat actor activities, potential leaked credentials, and vulnerability disclosures to identify threats relevant to CTOS.

· Product regular exposure reports and metrics, highlighting attack surface risks, potential impact, remediation status, and areas requirement attention or risk treatment.

Governance & Stakeholder Management

· Support the communication, implementation, monitoring, and enforcement of approved cybersecurity policies, standards, procedures, and related control requirements across the organisation.

· Build and maintain strong relationships and collaboration with internal and external stakeholders.

· Support the preparation of risk reports, dashboards, committee papers, and management updates.

Qualifications

· Bachelor’s Degree in information security, computer science, technology, or related discipline.

· Professional certifications such as CISM, CRISC, CEH, OSCP, CompTIA, or equivalent.

Work Experience

· 3 – 7 years of experience in Information Security or Cybersecurity domains such as penetration testing, vulnerability management, application security, or a related field.

· Familiarity with industry standards and regulatory frameworks such as CIS controls, BNM RMiT, CSA’s Cloud Control Matrix, ISO 27001 or similar standards.

Knowledge, Skills & Competencies

· Knowledge in attack surface management, penetration testing tools and methodologies, vulnerability management, and application security.

· Good understanding of end-to-end cyber threat and vulnerability management lifecycle (e.g. patching lifecycle).

· Practical hands-on experience in conducting or coordinating security assessments and vulnerability management activities.

· Familiarity with vulnerability assessment, application security, and attack surface management tools, such as Nessus, Burp Suite, CrowdStrike, or equivalent enterprise security platforms, with the ability to interpret outputs, validate findings with technical teams, consolidate data, and track remediation through the vulnerability management programme.

· Understanding of adversary tactics, techniques, and procedures (TTP) and their impact on organisational security.

· Ability to assess emerging cyber threats, including those related to cloud, AI and automation.

· Strong stakeholder management and cross-functional coordination skills.

· Effective verbal and written communication skills, with the ability to engage both technical and non-technical audiences.